CVE-2026-76904

CVE-2026-76904 represents a trust boundary violation at the core of GeoTools' value proposition. The library promises to translate OGC Filters into backend SQL safely, insulating developers from SQL injection concerns entirely. The jsonArrayContains function breaks this contract: it interpolates user-supplied filter values directly into SQL without sanitization, creating a direct injection path that exploits the very abstraction developers adopted to avoid thinking about SQL security. This is not a typical SQL injection because the attack surface is exposed through a standards-based API designed for untrusted input. Any application exposing OGC Filter query capabilities to users is vulnerable — which is precisely GeoTools' primary use case. The PostGIS 12+ version gating compounds the problem: the vulnerability only manifests in specific deployment configurations, meaning it likely escaped detection in CI pipelines running against earlier PostGIS versions. The connection pool rights mitigation is architecturally backwards. It pushes security-critical decisions downstream to every GeoTools consumer, requiring each to understand implementation details of a single function. This violates the principle that security boundaries should be enforced at the library interface, not delegated to application logic. The critical question is whether version 33.6/34.5 establishes a sustainable fix pattern or simply patches one hole. If the fix uses parameterized queries for jsonArrayContains but leaves other PostGIS-specific extension functions unaudited, the vulnerability has relocated rather than been eliminated. The extension mechanism itself — where backend-specific functions get added outside the core safe SQL generation discipline — is the sediment layer that produced this vulnerability and may produce the next one. Audit your GeoTools deployment: confirm you are on 33.6 or 34.5+, verify that jsonArrayContains is not in use with untrusted filter input, and evaluate whether other PostGIS-specific functions in your codebase follow the same unsafe interpolation pattern. The fix may work for this function while the architectural problem that created it remains.

Reviewed through automated stages and approved by a human before publication.